Credential disclosure via retained cross-origin Authorization header

Information disclosure in Deno before 2.1.2 allows remote attackers to read Authorization headers through cross-origin redirects. The fetch() redirect handler constructs a follow-up request for a different origin without removing the original request's Authorization header. Exploitation requires an application to send credentials with fetch() and follow a redirect to an attacker-observable origin, exposing the complete header value without altering data or interrupting service.